Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

ansible/group_vars/all.yml

@@ -0,0 +1,22 @@
+---
+# Domains
+domain_base: ladkau.de
+domain_cloud:      "cloud.{{ domain_base }}"
+domain_gitea:      "gitea.{{ domain_base }}"
+domain_nextcloud:  "nextcloud.{{ domain_base }}"
+domain_sso:        "sso.{{ domain_base }}"
+domain_mail:       "mail.{{ domain_base }}"
+domain_registry:   "cr.{{ domain_base }}"
+domain_k8s:        "k8s.{{ domain_base }}"
+
+# Let's Encrypt
+acme_email: matthias.ladkau@gmail.com
+
+# Non-root deploy user created by the base role
+deploy_user: deploy
+
+# System timezone
+timezone: Europe/Berlin
+
+# Docker network shared by all services and Traefik
+traefik_network: traefik_public